4 ms·

You don't create a new bootloader that allows users the freedom to run an unsigned third party OS without having it degrade the system's security if and when th

You don't create a new bootloader that allows users the freedom to run an unsigned third party OS without having it degrade the system's security if and when they boot the native OS because you are "hostile to developers and hackers".

fsflover 3y ago
My laptop can use TPM and a hardware key with my keys and free software. Where is the degraded security?
- hedora 3y ago
  I could trick you into adding a hardware key, then install a tampered version of Windows with it. (Also, the last time I looked, TPM keys could be grabbed with ~ $100 of hardware, but I think that's fixed by some newer standard.) But, yeah, it's not a big tradeoff in practice. I think their point was that Apple had to expend effort to enable the use case, which isn't "hostile" toward the use case.
  - GeekyBear 3y ago
    > I could trick you into adding a hardware key, then install a tampered version of Windows with it. There are other issues as well. For instance, on a PC the security settings are applied per machine and not per partition, so you can't mix an unsigned OS on one partition with full security on another partition. Also: > On Wednesday, researchers at security firm ESET presented a deep-dive analysis of the world’s first in-the-wild UEFI bootkit that bypasses Secure Boot on fully updated UEFI systems running fully updated versions of Windows 10 and 11. Despite Microsoft releasing new patched software, the vulnerable signed binaries have yet to be added to the UEFI revocation list that flags boot files that should no longer be trusted. https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/ https://arstechnica.com/information-technology/2023/03/unkil...
    - hedora 3y ago
      > For instance, on a PC the security settings are applied per machine and not per partition, so you can't mix an unsigned OS on one partition with full security on another partition. This wasn't true for a low-end Acer I bought a while ago, and it's not true on an Asus motherboard I use. You can add keys to the bios, and then it'll let you run with either key. That lets you use the grub shim key. On the Acer, you can even tell it to screw PKI, and just check that the hash of the bootloader hasn't changed.
- rodgerd 3y ago
  You seem unfamiliar with the Alder Lake compromise.
  - fsflover 3y ago
    Indeed. Care to give a link? Quick DuckDuckGo search returned nothing.
    - rodgerd 3y ago
      Sure: https://arstechnica.com/information-technology/2023/05/leak-of-msi-uefi-signing-keys-stokes-concerns-of-doomsday-supply-chain-attack/ https://arstechnica.com/information-technology/2023/05/leak-... The gaggle of moving parts that are involved in the PC world make security and privacy substantially more challenging because of nonsense like this - a vendor with rubbish security (not even an HSM for critical signing keys!) compromising the broader world.
      - fsflover 3y ago
        Thanks. It seems this confirms that my own keys are more secure, because with them such problem couldn't occur.

fsflover 3y ago

My laptop can use TPM and a hardware key with my keys and free software. Where is the degraded security?

hedora 3y ago
I could trick you into adding a hardware key, then install a tampered version of Windows with it. (Also, the last time I looked, TPM keys could be grabbed with ~ $100 of hardware, but I think that's fixed by some newer standard.) But, yeah, it's not a big tradeoff in practice. I think their point was that Apple had to expend effort to enable the use case, which isn't "hostile" toward the use case.
- GeekyBear 3y ago
  > I could trick you into adding a hardware key, then install a tampered version of Windows with it. There are other issues as well. For instance, on a PC the security settings are applied per machine and not per partition, so you can't mix an unsigned OS on one partition with full security on another partition. Also: > On Wednesday, researchers at security firm ESET presented a deep-dive analysis of the world’s first in-the-wild UEFI bootkit that bypasses Secure Boot on fully updated UEFI systems running fully updated versions of Windows 10 and 11. Despite Microsoft releasing new patched software, the vulnerable signed binaries have yet to be added to the UEFI revocation list that flags boot files that should no longer be trusted. https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/ https://arstechnica.com/information-technology/2023/03/unkil...
  - hedora 3y ago
    > For instance, on a PC the security settings are applied per machine and not per partition, so you can't mix an unsigned OS on one partition with full security on another partition. This wasn't true for a low-end Acer I bought a while ago, and it's not true on an Asus motherboard I use. You can add keys to the bios, and then it'll let you run with either key. That lets you use the grub shim key. On the Acer, you can even tell it to screw PKI, and just check that the hash of the bootloader hasn't changed.
rodgerd 3y ago
You seem unfamiliar with the Alder Lake compromise.
- fsflover 3y ago
  Indeed. Care to give a link? Quick DuckDuckGo search returned nothing.
  - rodgerd 3y ago
    Sure: https://arstechnica.com/information-technology/2023/05/leak-of-msi-uefi-signing-keys-stokes-concerns-of-doomsday-supply-chain-attack/ https://arstechnica.com/information-technology/2023/05/leak-... The gaggle of moving parts that are involved in the PC world make security and privacy substantially more challenging because of nonsense like this - a vendor with rubbish security (not even an HSM for critical signing keys!) compromising the broader world.
    - fsflover 3y ago
      Thanks. It seems this confirms that my own keys are more secure, because with them such problem couldn't occur.